Skip to navigation

Threat reportMalwareTL-2026-2455

ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2

highACTIVE

ScarfaceStealer is an actively distributed Windows infostealer family (tracked since December 2025) whose latest build, analyzed by Joe Security on 2026-07-14, is delivered via an NSIS-packaged Electron application masquerading as an AI tool named ClaudeMythos.exe. The dropper performs hardware-based sandbox checks before a final payload scores eleven environmental indicators and, if it passes, retrieves its C2 address from an Ethereum/Polygon smart contract using an EtherHiding-style dead-drop resolver. First disclosed .

Key facts for ScarfaceStealer Ethereum smart contract C2

IdentifiersTL-2026-2455
Also known asScarfaceStealer.Rocket, Scarface Stealer
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsN/A (trojanized third-party Electron applications, not a vendor product vulnerability) Windows hosts on which a ScarfaceStealer-trojanized Electron/NSIS installer (e.g. ClaudeMythos.exe, Kitchen Canvas, Food or Meal Formula, DocConvertWizard) is executed
MalwareScarfaceStealer, ScarfaceStealer.Rocket
Tools0x25C73C98F0E509Bd909cd1C1456EB973Dda60344
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1027.002 Software Packing, T1036 Masquerading, T1057 Process Discovery, T1059.001 PowerShell, T1071.001 Web Protocols, T1082 System Information Discovery, T1102.001 Dead Drop Resolver, T1113 Screen Capture, T1123 Audio Capture, T1204.002 Malicious File, T1497.001 System Checks and 6 more in the attack flow
MotivationFINANCIAL
Detection rules9 (1 shown free)
Sources5 cited sources

Detection coverage for ScarfaceStealer Ethereum smart contract C2

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2455 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ScarfaceStealer — ClaudeMythos.exe Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController

Detects execution of the ScarfaceStealer trojanized Electron/NSIS lure (ClaudeMythos.exe, or sibling lures Kitchen Canvas / Food or Meal Formula / DocConvertWizard) followed within a short window by a PowerShell query against the Win32_VideoController WMI class, which the Electron-stage loader uses to validate the GPU vendor before unpacking the final payload. The two-event correlation distinguishes this from routine hardware-inventory PowerShell use.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1036, T1059.001, T1027.002
  • Data sources: sysmon, windows_security, powershell_operational, edr_process_telemetry
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(Image, "(?i)\\\\(ClaudeMythos\.exe|Kitchen ?Canvas\.exe|Food ?or ?Meal ?Formula\.exe|DocConvertWizard\.exe)$") OR match(CommandLine, "(?i)ClaudeMythos|Kitchen Canvas|Food or Meal Formula|DocConvertWizard")
| eval lure_time=_time, lure_host=ComputerName, lure_image=Image, lure_guid=ProcessGuid
| join type=left ComputerName
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\powershell.exe" CommandLine="*Win32_VideoController*"
      | eval ps_time=_time
      | fields ComputerName, ps_time, CommandLine, ParentImage, User ]
| where isnotnull(ps_time) AND (ps_time - lure_time) >= 0 AND (ps_time - lure_time) <= 120
| table lure_time, lure_host, lure_image, User, CommandLine, ps_time
| sort - lure_time

Microsoft KQL

let LureProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("ClaudeMythos.exe") or ProcessCommandLine has_any ("ClaudeMythos", "Kitchen Canvas", "Food or Meal Formula", "DocConvertWizard")
| project LureTime = Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessAccountName;
let WmiGpuQuery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe" and ProcessCommandLine has "Win32_VideoController"
| project WmiTime = Timestamp, DeviceId, ProcessCommandLine;
LureProcess
| join kind=inner WmiGpuQuery on DeviceId
| where WmiTime - LureTime between (0min .. 5min)
| project LureTime, WmiTime, DeviceName, FileName, SHA256, ProcessCommandLine, InitiatingProcessAccountName
| sort by LureTime desc

Sigma

title: ScarfaceStealer ClaudeMythos Lure Execution or GPU Fingerprint via Win32_VideoController
id: 7c1e9f2a-3b5d-4e6a-9a1c-2f8d4b6e7a10
status: experimental
description: Detects execution of the ScarfaceStealer Electron/NSIS lure (ClaudeMythos.exe and sibling lure names) or a PowerShell query against Win32_VideoController consistent with the family's GPU-vendor pre-check.
references:
  - https://www.joesecurity.org/blog/691434271001776522
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1036
  - attack.t1027.002
  - attack.software_packing
logsource:
  category: process_creation
  product: windows
detection:
  selection_lure_image:
    Image|endswith:
      - '\ClaudeMythos.exe'
      - '\DocConvertWizard.exe'
  selection_lure_cmdline:
    CommandLine|contains:
      - 'ClaudeMythos'
      - 'Kitchen Canvas'
      - 'Food or Meal Formula'
      - 'DocConvertWizard'
  selection_wmi_gpu_check:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: 'Win32_VideoController'
  condition: selection_lure_image or selection_lure_cmdline or selection_wmi_gpu_check
falsepositives:
  - IT asset-management or hardware-inventory scripts querying Win32_VideoController
  - Legitimate software sharing a coincidentally similar generic filename
level: high

Known false positives:

  • Legitimate IT asset-management or hardware-inventory PowerShell scripts querying Win32_VideoController
  • Users installing an unrelated legitimate application that happens to share a generic lure filename pattern

Tuning notes: Narrow the Win32_VideoController correlation window to <=60s after installer execution to reduce noise from unrelated periodic inventory jobs; allowlist known IT asset-management scripts by code-signing hash/signer.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ScarfaceStealer — [indicator] Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController · unlock with TL Creds
  • ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] · unlock with TL Creds
  • ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon · unlock with TL Creds
  • ScarfaceStealer — [indicator] Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController · unlock with TL Creds
  • ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] · unlock with TL Creds
  • ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon · unlock with TL Creds
  • ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] · unlock with TL Creds
  • ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon · unlock with TL Creds

Indicators of compromise for ScarfaceStealer Ethereum smart contract C2

As of 2026-09-12, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-2455.

Sample indicators (3 of 15)

  • Domain: check[.]mentor-square80[.]click
  • File hash: 42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2
  • File hash: 2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

15 indicators of compromise · unlock with TL Creds. Compare plans

How ScarfaceStealer Ethereum smart contract C2 works

ScarfaceStealer is a Windows information-stealer family first observed in the wild on 2025-12-03 (MalwareBazaar), with 196 tracked samples submitted through at least 2026-08-10. An earlier, Go-compiled build documented by SonicWall on 2026-03-15 (internally flagged as ScarfaceStealer.Rocket) targets browser cookies, saved passwords, browsing history and autofill data, alongside hardware fingerprinting, network configuration, installed-software enumeration, and functions consistent with microphone and screenshot capture. That build is heavily obfuscated with space/rocket-themed junk strings and randomly concatenated English-word function names (e.g. LAUNCH_COMMAND, TELEMETRY, IGNITION, MISSION_ABORT), leaving only 47 human-readable strings visible under static analysis, and exfiltrates over HTTP/TLS.

The variant analyzed by Joe Security on 2026-07-14 represents a distribution and anti-analysis evolution of the same family. It is delivered as an NSIS-packaged Electron application disguised as an AI-themed utility named ClaudeMythos.exe (sibling lures observed for the family include Kitchen Canvas, Food or Meal Formula, and DocConvertWizard). Infection proceeds in two evasion stages: (1) the Electron/JavaScript loader enforces minimum hardware thresholds (>=4GB RAM, >=2 CPU cores) and validates the GPU vendor via a PowerShell query against the Win32_VideoController WMI class, silently exiting via app.quit()/process.exit(0) if unmet; (2) the unpacked final payload runs a weighted 11-indicator sandbox-suspicion scorer covering analysis-tool/debugger process names, CPU core count, physical RAM, GPU vendor allow-list, username blocklist, system uptime plausibility, sleep-timing accuracy, remote-session detection (GetSystemMetrics/SM_REMOTESESSION), CPU instruction (__cpuid) timing, CPUID leaf vendor/brand consistency, and GPU PCI vendor-ID blocklisting against common hypervisor IDs (QEMU/BOCHS 0x1234, VMware 0x15AD, VirtualBox 0x80EE, QEMU VirtIO 0x1B36, Red Hat VirtIO 0x1AF4, Google Compute Engine 0x1AE0). A score of 7 or higher routes execution into a decoy loop of continuous message boxes instead of the payload. Internal strings are protected with a modified FNV-1a hash (UTF-16LE, custom seed 0xeb1af681 rather than the standard 0x811c9dc5).

Once evasion checks pass, the payload retrieves its C2 configuration from the Polygon blockchain by issuing an eth_call (function selector 0xd040556c) against the smart contract at 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 via the public RPC endpoint polygon.drpc.org. The ABI-encoded response is decoded and then decrypted with AES-256-CBC to yield the live C2 endpoint check.mentor-square80.click:443, which is subsequently queried at the path /api/v3/health using a static Chrome 146 User-Agent string. This dead-drop-resolver pattern -- storing and rotating C2 addresses inside a public, takedown-resistant smart contract rather than DNS/IP infrastructure -- places the sample in the broader 'EtherHiding' technique family also used by malware such as EtherRAT and Tsundere (per eSentire's 2026-03-25 analysis), which similarly abuse Ethereum/BNB smart contracts and public RPC providers to survive infrastructure takedowns and re-task already-compromised hosts.

The ClaudeMythos.exe lure specifically targets users seeking AI tools, aligning with the broader trend of trojanized 'AI utility' Electron apps used as an infostealer delivery vector.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1497.001 System Checks; T1497.003 Time Based Checks; T1620 Reflective Code Loading; T1622 Debugger Evasion

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography

Collection

T1113 Screen Capture; T1123 Audio Capture

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Remediation for ScarfaceStealer Ethereum smart contract C2

Immediate actions

  • Block/alert on DNS and TLS connections to check.mentor-square80.click and the /api/v3/health beacon path at the perimeter and on endpoints
  • Alert on outbound eth_call/JSON-RPC traffic to polygon.drpc.org (or other public Polygon/Ethereum RPC endpoints) from standard user workstations, and specifically on queries referencing contract 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 with selector 0xd040556c
  • Hunt for and quarantine executables named ClaudeMythos.exe, Kitchen Canvas, Food or Meal Formula, or DocConvertWizard, and for file hashes matching the SHA-256 IOCs below
  • Isolate and forensically image any host that ran a matching sample; force-rotate browser-stored passwords, cookies/session tokens, and any credentials autofilled on that host

Workarounds

  • Restrict standard users from installing/running unsigned Electron applications, especially ones sourced outside official app stores or vendor sites
  • Where feasible, constrain PowerShell execution policy for standard users to reduce the loader's ability to run its Win32_VideoController fingerprinting query

Longer-term hardening

  • Add behavioral detections for pre-execution hypervisor/GPU fingerprinting (PCI vendor IDs 0x1234, 0x15AD, 0x80EE, 0x1B36, 0x1AF4, 0x1AE0) and for PowerShell queries against Win32_VideoController immediately following execution of a newly downloaded Electron/NSIS installer
  • Extend network detection content to treat public blockchain RPC endpoints (drpc.org, infura.io, alchemy.com, etc.) as a monitored C2-resolver channel, not just conventional DNS/IP infrastructure
  • Enforce application allow-listing / code-signing verification to block unsigned Electron+NSIS installers, particularly ones downloaded as 'AI tools' from non-vendor sources
  • Track the ScarfaceStealer family in threat intel tooling (MalwareBazaar signature ScarfaceStealer, ThreatFox tag ScarfaceStealer) given its continued active sample submissions through 2026-08-10

Affected and fixed versions

  • N/A (trojanized third-party Electron applications, not a vendor product vulnerability) — Windows hosts on which a ScarfaceStealer-trojanized Electron/NSIS installer (e.g. ClaudeMythos.exe, Kitchen Canvas, Food or Meal Formula, DocConvertWizard) is executed
    Vulnerable versions: Any Windows version capable of running Electron/NSIS-packaged applications

Timeline of ScarfaceStealer Ethereum smart contract C2

  • Earliest locked-ioc-13 sample submitted to MalwareBazaar, marking the family's first tracked appearance.
  • First locked-ioc-13 indicator recorded in ThreatFox's tracking database.
  • Most recent ThreatFox sighting recorded prior to Joe Security's Electron/EtherHiding report.
  • SonicWall publishes 'An In-Depth Look at Scarface Stealer,' detailing a Go-compiled locked-ioc-8 build with heavy space/rocket-themed string and function-name obfuscation.
  • eSentire publishes analysis of EtherRAT and the broader EtherHiding technique family (blockchain smart-contract C2 dead-drop resolvers), the same technique class Joe Security later attributes to locked-ioc-13's C2 retrieval.
  • Joe Security publishes 'Inside locked-ioc-13's Sandbox-Aware Anti-Analysis System,' analyzing the locked-ioc-11 Electron/NSIS sample with its 11-indicator scoring system and Ethereum/Polygon smart-contract C2.
  • Most recent locked-ioc-13 sample (of 196 tracked total) submitted to MalwareBazaar, indicating an active, ongoing campaign.

Sources cited for ScarfaceStealer Ethereum smart contract C2

Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats